Threat reportEspionageTL-2026-1624
Russian Intelligence Services Hijack Unsecured IP Cameras Across NATO, EU and Ukraine to Surveil Weapons Deliveries (AIVD/MIVD Advisory, Censys Analysis)
Russian Intelligence Services Hijack Unsecured IP Cameras (TL-2026-1624) is a high-severity espionage campaign scored CVSS 9.8, first published 2026-07-22. It is linked to a Russia-nexus actor with high confidence, affects Dropbear SSH Project Dropbear SSH, references 2 CVEs (CVE-2016-7407, CVE-2021-39275), maps to 15 MITRE ATT&CK techniques (T1005, T1046, T1074), and is covered by 9 detection rules and 15 indicators of compromise.
- CVSS
- 9.8/10High
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 15MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 15Indicators of compromise
Key facts for TL-2026-1624
- Threat ID
- TL-2026-1624
- Severity
- HIGH
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- ESPIONAGE
- First published
- Last reviewed
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- government administration, defense, critical-infrastructure, logistics, transport
- Target regions
- netherlands, European Union, NATO member states, ukraine, france, germany, italy, spain, united kingdom, poland
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in Russian Intelligence Services Hijack Unsecured IP Cameras
Malware and tooling: Apache HTTP Server, Dropbear SSH
How Russian Intelligence Services Hijack Unsecured IP Cameras works
Dutch intelligence services AIVD and MIVD, in a joint advisory published July 10, 2026, confirm that at least one Russian intelligence service is systematically compromising internet-connected IP cameras across the Netherlands, EU, NATO countries, and Ukraine to surveil weapons deliveries and military transport routes supporting Ukraine. Censys analysis found more than 87,000 exposed cameras across eight European countries and Ukraine running services matching known-exploited vulnerabilities, with camera access in Ukraine reportedly used to help target Ukrainian military personnel and equipment.
On July 10, 2026, the Netherlands' civilian intelligence service (AIVD -- Algemene Inlichtingen- en Veiligheidsdienst) and military intelligence service (MIVD -- Militaire Inlichtingen- en Veiligheidsdienst) jointly published an advisory warning that at least one Russian intelligence service is conducting a large-scale, ongoing digital espionage campaign against civilian internet-connected IP cameras. Rather than penetrating hardened, defended military networks, the operation targets poorly secured, internet-facing surveillance cameras overlooking roads, ports, loading areas, gas stations, and other logistics routes used to move Western weapons and equipment to Kyiv. Operators scan the public internet for exposed camera devices, fingerprint them by brand, and gain access via default passwords, outdated/unpatched firmware, and factory-default configurations -- no zero-day exploits are required. Once inside, AI-powered image-recognition software automatically searches captured video for military vehicles, cargo, transport routes, and personnel, correlating findings across many compromised feeds at scale to build a picture of Western military logistics supporting Ukraine. The advisory frames this as a systematic escalation of digital espionage activity since Russia's February 2022 full-scale invasion of Ukraine, noting a single public-facing camera (e.g., a roadside gas-station feed) can provide meaningful operational intelligence with no direct network intrusion required.
Cybersecurity firm Censys independently quantified the exposure in a July 16, 2026 report, building on an earlier Censys camera-exposure blog from March 2026 (published in the aftermath of the Iran conflict, which first flagged the broader trend of adversaries harvesting open camera feeds for military-relevant reconnaissance). The July 2026 Censys analysis found more than 87,000 internet-connected cameras across EU, NATO, and Ukrainian networks running services matching known-exploited vulnerabilities, including CVE-2016-7407 (Dropbear SSH arbitrary code execution via crafted local key-import, publicly known since March 2017) and CVE-2021-39275 (Apache HTTP Server out-of-bounds write / buffer overflow, CVSS 9.8, patched in Apache 2.4.49). Country-level Censys totals: Netherlands 45,386 cameras / 1,992 vulnerable (159 tied to the Dropbear SSH flaw, 112 to the Apache flaw, 541 to other camera-specific bugs); Ukraine 60,487 cameras / 4,097 vulnerable; France 68,317 cameras / 8,977 vulnerable; Germany 65,539 cameras / 8,401 vulnerable; Italy 99,203 cameras / 12,678 vulnerable; Spain 81,371 cameras / 8,685 vulnerable; United Kingdom 113,962 cameras / 7,142 vulnerable; Poland 57,534 cameras / 4,250 vulnerable. Camera brands referenced in vendor fingerprinting discussions of this exposed population include Hikvision, Mobotix, Amcrest, Dahua, Hanwha, and Bosch, though AIVD/MIVD did not attribute the specific breached devices to any one vendor.
AIVD and MIVD state that within the Netherlands they confirmed only a small number of actually-breached cameras, several of which sat directly on military logistics routes; the responsible organizations were notified so the devices could be secured. The agencies did not name a specific Russian service (GRU, SVR, or FSB), stating only that "at least one Russian intelligence service" is responsible, and characterize the operation as collecting intelligence that in some cases is not directly relevant to the war but broadly useful to Russian state interests. Within Ukraine itself, the Dutch services state camera-derived intelligence has been used in attempts to locate and neutralise Ukrainian military personnel and materiel -- i.e., the surveillance has fed into targeting decisions rather than remaining passive collection. No such lethal downstream use has been observed for camera intelligence gathered outside Ukraine to date. AIVD/MIVD recommend camera owners change default credentials, disable UPnP and direct port-forwarding, route remote access through a VPN, enable MFA where supported, mask sensitive fields of view, and consider the geopolitical origin of camera hardware (flagging China, Russia, and Iran as supply-chain risk factors) when procuring devices.
MITRE ATT&CK techniques used in TL-2026-1624
Collection
T1005 Data from Local System; T1074 Data Staged; T1119 Automated Collection; T1125 Video Capture
Discovery
T1046 Network Service Discovery; T1518 Software Discovery
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Persistence
T1133 External Remote Services
Defense Evasion
T1211 Exploitation for Stealth
Resource Development
T1583 Acquire Infrastructure; T1588 Obtain Capabilities
Reconnaissance
T1590 Gather Victim Network Information; T1592 Gather Victim Host Information; T1595 Active Scanning
Affected products and versions in Russian Intelligence Services Hijack Unsecured IP Cameras
- Dropbear SSH Project — Dropbear SSH
Vulnerable versions: through 2016.73
Fixed in: 2016.74 and later - Apache Software Foundation — Apache HTTP Server
Vulnerable versions: up to and including 2.4.48
Fixed in: 2.4.49 and later - Multiple (generic IP camera hardware) — Internet-connected IP cameras (brands referenced in exposure analysis: Hikvision, Mobotix, Amcrest, Dahua, Hanwha, Bosch)
Vulnerable versions: devices with default credentials, outdated firmware, or factory-default configurations exposed to the public internet
Remediation for Russian Intelligence Services Hijack Unsecured IP Cameras
Patches
- Upgrade Dropbear SSH to 2016.74 or later (fixes CVE-2016-7407)
- Upgrade Apache HTTP Server to 2.4.49 or later (fixes CVE-2021-39275)
Immediate actions
- Change default administrator credentials on all internet-connected IP cameras immediately upon installation
- Disable UPnP and direct port-forwarding of camera management/RTSP ports to the public internet
- Route all remote camera access through a VPN rather than direct internet exposure
- Patch or replace devices running Dropbear SSH versions affected by CVE-2016-7407
- Patch or replace devices running Apache HTTP Server versions affected by CVE-2021-39275 (upgrade to 2.4.49 or later)
- Run an internet-exposure scan (Censys/Shodan-style) against the organization's camera fleet to identify any publicly reachable devices
Workarounds
- Segment camera networks from other infrastructure and restrict outbound/inbound access via firewall ACLs
- Consider the geopolitical origin of camera hardware/firmware supply chains (China, Russia, Iran flagged as risk factors) during procurement
- Physically reposition or mask cameras overlooking military logistics routes, ports, and loading areas where remediation is not immediately possible
Longer-term hardening
- Enable multi-factor authentication on camera management interfaces where supported
- Mask or blur camera fields of view that overlook sensitive logistics routes, loading areas, or military transport corridors
- Maintain a firmware update program for all internet-facing IoT/surveillance devices
- Conduct periodic internet-exposure scanning (e.g., Censys/Shodan-style asset discovery) of camera fleets
- Establish an asset inventory / CMDB entry for every internet-facing camera, including firmware version and vendor, to enable rapid patch-gap identification
CVEs associated with Russian Intelligence Services Hijack Unsecured IP Cameras
Weaknesses (CWE) in Russian Intelligence Services Hijack Unsecured IP Cameras
Timeline of Russian Intelligence Services Hijack Unsecured IP Cameras
- AIVD/MIVD describe a systematic increase in Russian digital espionage activity targeting civilian IP cameras coinciding with the start of Russia's full-scale invasion of Ukraine.
- Censys publishes an earlier blog on adversaries harvesting open internet-connected camera feeds for military-relevant reconnaissance in the aftermath of the Iran conflict, establishing the analytical baseline later applied to the Russia campaign.
- Netherlands' AIVD (civilian intelligence) and MIVD (military intelligence) jointly publish an advisory confirming at least one Russian intelligence service is compromising internet-connected IP cameras to surveil weapons deliveries and military logistics routes.
- The Hacker News, Security Affairs, Ukrainska Pravda, UNITED24 Media, Cyberpress, and Cybernews publish coverage of the AIVD/MIVD advisory, adding detail on Ukraine-specific targeting of military personnel.
- Censys report details country-level exposure figures, including Italy (99,203 cameras / 12,678 vulnerable) and the United Kingdom (113,962 cameras / 7,142 vulnerable) as the largest exposed populations by raw camera count.
- Censys publishes independent internet-exposure analysis quantifying more than 87,000 vulnerable cameras across the Netherlands, France, Germany, Italy, Spain, UK, Poland, and Ukraine, identifying CVE-2016-7407 and CVE-2021-39275 as contributing known-exploited vulnerabilities.
- The Hacker News publishes a follow-up technical analysis of the campaign attribution and TTPs, reiterating that AIVD/MIVD stopped short of naming a specific Russian intelligence agency (GRU, SVR, or FSB).
- Cyber Security News publishes a summary article on the campaign, cited as the TL-Intel hunt source for TL-2026-1624.
Sources cited for Russian Intelligence Services Hijack Unsecured IP Cameras
- Russian Intelligence Hijacks IP Cameras to Monitor Weapons Deliveries to Ukraine
- Russian Intelligence Hacks IP Cameras to Spy on Military Logistics Across NATO States and Ukraine
- Dutch Intelligence Warns Russia Uses Hacked IP Cameras for Military Espionage
- Inside Russia's Camera-Hacking Espionage Campaign
- Russia uses hacked cameras across NATO countries to monitor arms deliveries to Ukraine
- Russia Turned Civilian Security Cameras Across Europe Into Spy Network, Intelligence Reveals
- Russian spies are peeping through cameras all over Europe, and too many of them are wide open
- Russian Spies Are Hacking Security Cameras to Track NATO Weapons Shipments
- 87,000 vulnerable IP cameras in Europe could be exploited by Russian intelligence services -- Censys report
- NVD - CVE-2021-39275
- NVD - CVE-2016-7407
Detection coverage for TL-2026-1624
As of 2026-07-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1624 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.